Rig Exploit Kit via pseudoDarkleech from 81.177.135.105 delivers Cerber ransomware

NOTES:

I have added a zipped pcap file for your analysis. The password for the zipped pcap is infected all lowercase.

PCAP file of the infection traffic:
2016-12-23-Rig-EK-pcap.zip

 

ASSOCIATED DOMAINS AND IP ADDRESSES:

  • www.nickyclarke.com – COMPROMISED SITE
  • 81.177.135.105 – need.probateservicellc.com – RIG-V LANDING PAGE
  • 23.152.0.167 – ffoqr3ug7m726zou.1nc6uc.top – CERBER POST INFECT TRAFFIC
  • 33.22.15.0 – 33.23.16.255 UDP Port 6892 – CERBER POST INFECT TRAFFIC
  • 91.239.24.0 – 91.239.25.255 UDP Port 6892 – CERBER POST INFECT TRAFFIC

 

IMAGES AND DETAILS OF INFECTION CHAIN:

Shown above: Network traffic  associated with the Rig-V exploit and Cerber ransomware infection

 

Shown above: Injected script found on index page of compromised site which redirects visitor to the Rig-V EK landing page to start infection chain – Web page source code can be found by right clicking on web page and selecting “View source”

 

Shown above: Infected host desktop ransom note and payment instructions associated with Cerber Ransomware

 

Shown above: After extracting Rig-V flash exploit and saving as .swf file, decompiled using Flare (http://www.nowrap.de/flare.html) and examined flash meta data with text editor.

 

MALICIOUS PAYLOAD ASSOCIATED WITH RIG EXPLOIT: